CVE-2001-0867
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.71% probability · 76th percentile
- CISA KEV
- Not listed
- Affected
- cisco/12000 router
- Source
- cve@mitre.org
References
- http://www.ciac.org/ciac/bulletins/m-018.shtml
- http://www.cisco.com/warp/public/707/GSR-ACL-pub.shtml
- http://www.osvdb.org/1989
- http://www.securityfocus.com/bid/3538
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7555
- http://www.ciac.org/ciac/bulletins/m-018.shtml
- http://www.cisco.com/warp/public/707/GSR-ACL-pub.shtml
- http://www.osvdb.org/1989
- http://www.securityfocus.com/bid/3538
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7555
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.